2019 to 2020 Annual Report on the Privacy Act

On this page

• 1. Introduction
• 2. Mandate of the Treasury Board of Canada Secretariat
• 3. Organizational Structure
• 4. Delegation Order
• 5. Performance 2019-2020
• 6. Other Requests
• 7. Disposition of Completed Requests
• 8. Completion Time and Extensions
• 9. Exemptions Invoked
• 10. Exclusions Invoked
• 11. Costs
• 12. Impact to ATIP Operations as a Result of the COVID-19 Pandemic
• 13. Training and Awareness
• 14. Policies, Guidelines, Procedures and Initiatives
• 15. Summary of Key Issues and Actions Taken on Complaints or Audits
• 16. Monitoring Compliance
• 17. Material Privacy Breaches
• 18. Privacy Impact Assessments
• 19. Public Interest Disclosures
• 20. Information About Programs and Information
• Appendix A: Statistical Report on the Privacy Act
• 2019–2020 Supplemental Statistical Report – Requests affected by COVID-19 measures
• Appendix B: Delegation Order

1. Introduction

The Privacy Act provides Canadian citizens and permanent residents with the right of access to, and correction of, personal information about themselves that is under the control of a government institution. It also provides the legal framework for the collection, retention, use, disclosure, disposition and accuracy of personal information in the administration of programs and activities by government institutions subject to the act.

Under the Privacy Act, personal information is defined as “information about an identifiable individual that is recorded in any form.” Examples include information relating to the national or ethnic origin, colour, religion, age or marital status of an individual; the education or the medical, criminal, financial or employment history of an individual; the address, fingerprints or blood type of an individual; and, any identifying number, symbol or other particular identifier assigned to an individual.

Section 72 of the Privacy Act requires that the head of every government institution prepare for submission to Parliament an annual report on the administration of this Act within the institution during each financial year.

This report has been prepared and tabled in Parliament in accordance with section 72 of the Privacy Act. It covers the period from April 1, 2019 to March 31, 2020.

2. Mandate of the Treasury Board of Canada Secretariat

As the administrative arm of the Treasury Board, the Secretariat has a dual mandate: to support the Treasury Board as a committee of ministers and to fulfill the statutory responsibilities of a central government agency. The Treasury Board’s mandate is derived from the Financial Administration Act.

To fulfill its mandate, the Secretariat organizes its business and resources around four core responsibilities:

• Spending Oversight
• Administrative Leadership
• Employer
• Regulatory Oversight

The Secretariat is tasked with providing advice and support to Treasury Board ministers in their role of ensuring value-for-money, as well as providing oversight of the financial management functions in departments and agencies.

The Secretariat makes recommendations and provides advice to the Treasury Board on policies, directives, regulations, and program expenditure proposals with respect to the management of the government's resources. Its responsibilities for the general management of the government affect initiatives, issues, and activities that cut across all policy sectors managed by federal departments and organizational entities (as reported in the Main Estimates). The Secretariat is also responsible for the comptrollership function of government.

Within the Secretariat, the Comptroller General of Canada provides government-wide leadership, direction, oversight and capacity building for financial management, internal audit and the management of assets and acquired services. The Chief Human Resources Officer provides government-wide leadership on people management through policies, programs and strategic engagements, and by centrally managing labour relations, compensation, pensions and benefits, and contributing to the management of executives. The Chief Information Officer provides government-wide leadership, direction, oversight and capacity building for information management, information technology, government security (including identity management), access to information, privacy, and internal and external service delivery.

3. Organizational Structure

The Access to Information and Privacy (ATIP) office is part of the Ministerial Services Division of the Secretariat’s Strategic Communications and Ministerial Affairs Sector. This office is responsible for implementing and managing programs and services relating to the Secretariat’s administration of the Access to Information Act and the Privacy Act, as well as providing advice to its employees as they fulfill their obligations under both acts.

In fiscal year 2019 to 2020, the ATIP Office team was comprised of 20 employees, all of whom are dedicated to processing access and privacy requests, as well as related functions. The team consisted of a director supported by 3 managers, 16 advisors at various levels and 3 part-time university students. A consultant was hired near the end of the fiscal year to assist with the backlog of older complex operational files. There were two categories of responsibility, which included the following key activities:

Privacy Policy Unit (6 officers)

• Provided expertise on privacy policy to internal clients
• Developed procedures to optimize operations performance
• Produced privacy awareness and training program material
• Coordinated and reviewed updates to the Secretariat’s Info Source chapter
• Oversaw day-to-day issues management
• Provided advice and review of proactive disclosures and guidance on C-58 requirements

Operations (13 officers, 3 part-time students)

• Provided training and expertise on access to information to internal clients
• Provided database administration via an intake unit
• Processed access to information and privacy requests
• Carried out consultations with government organizations or third parties
• Responded to calls and informal requests for information
• Acted as the point of contact to resolve formal complaints by oversight bodies
• Maintained dialogue with sectors and other federal government institutions
• Provided advice, review and coordination of proactive disclosures and guidance on C-58 requirements
• Prepared the Secretariat’s annual reports to Parliament on the administration of the acts

Section 73.1 of the Privacy Act allows government institutions to provide services related to access to information to another government institution that is presided over by the same Minister. In fiscal year 2019 to 2020, the ATIP office did not provide any such services.

4. Delegation Order

Delegation orders set out what powers, duties and functions for the administration of the Privacy Act have been delegated by the head of the institution, and to whom.

The President has delegated most of the responsibilities set out in the Privacy Act to the following Secretariat officials: The Secretary of the Treasury Board, the Assistant Secretary of Strategic Communications and Ministerial Affairs, the Senior Director of Ministerial Services, and the Director of ATIP.

A copy of the approved Secretariat Delegation Order can be found in Appendix B.

5. Performance 2019-2020

Statistical reporting on the administration of the Access to Information Act and the Privacy Act has been in place since 1983. The statistical reports prepared by government institutions provide aggregate data on the application of the Access to Information Act and Privacy Act legislation. This information is compiled on an annual basis in a statistical information bulletin and is included with the annual reports on access to information and privacy, which are tabled in Parliament by each institution.

The Secretariat’s statistical report on the Privacy Act for fiscal year 2019 to 2020 is provided in Appendix A.

Table 1 presents an overview of the statistics for fiscal year 2019 to 2020 on the Secretariat’s processing of privacy requests in relation to statistics for the previous three years.

In the reporting period from April 1, 2019, to March 31, 2020, the Secretariat received a total of 87 new requests under the Privacy Act. This represents an increase of 10 requests (12%) from last year’s total of 77. In addition to the new requests, eight requests were carried forward from the 2018 to 2019 fiscal year.

Many of the new requests filed under the Privacy Act were from current and former federal public service employees. Requests had to do with personnel or staff relations issues that required the Secretariat’s involvement.

In fiscal year 2019 to 2020, the Secretariat’s ATIP Office responded to a total of 88 requests for personal information under the Privacy Act, involving the review of 4,433 pages. Although the ATIP office processed 12 more requests compared to last year, the number of pages processed decreased. Of note, the increase of pages processed for last fiscal year was the result of the closing of two voluminous files from previous fiscal years.

Of the 88 requests completed, 10 were abandoned by the applicant (12%) and 50 were identified as “no records exist” (57%) as most were related to subjects within the mandates of other federal institutions. In these cases, the ATIP Office communicated with the requester to redirect them to the institution of greater interest as part of its duty to assist.

Of the remaining 28 requests completed, 14 requests (5%) were fully disclosed and 14 (5%) were partially disclosed with a release of 3,874 pages in total. Records were sought and provided on paper in 7 cases and in electronic format in 21 cases.

A total of eight requests were carried over to the next reporting period. This is one less than last year’s total.

Despite numerous staff turnover challenges, the ATIP office was successful in achieving a 98.9% on-time compliance rate.

6. Other Requests

During the reporting period, the Secretariat responded to nine privacy consultation requests under the Privacy Act from other government institutions involving Secretariat records or issues.

As in previous years, the ATIP office, on over 275 occasions, acted as a source of expertise for Secretariat officials by providing advice and guidance on the provisions set out in the legislation. The Office was further consulted on the collection and disclosure of data on a wide range of subjects and the review of 277 proactive disclosures of travel and hospitality expense entries on the Open Government website as well as on audit reports to be published.

Throughout the year, the ATIP office continued to receive frequent enquiries from the general public seeking guidance on how to obtain information under the Access to Information Act and the Privacy Act, and where to forward their requests. Many of these enquiries were redirected to other federal government institutions, and occasionally, to provincial Freedom of Information and Privacy offices.

7. Disposition of Completed Requests

In fiscal year 2019 to 2020, a total of 88 requests were completed. Table 2 provides an overview of the disposition of the completed requests.

Given that the President of the Treasury Board is responsible for ensuring compliance with the Access to Information Act and the Privacy Act government-wide, the Secretariat often receives requests that fall within the mandates of other federal organizations. Such requests are registered, reviewed and closed after advising the requester of the appropriate organization. In Table 2, these requests are included in the totals for the “No records exist” category.

8. Completion Time and Extensions

The legislation sets timelines for responding to privacy requests and allows for extensions when the response requires the review of a large amount of information, consultations with other organizations, or extra time for translation purposes.

Table 3 presents the response times for the 88 requests that the Secretariat completed in fiscal year 2019 to 2020.

The Secretariat received many requests that fell within the mandates of other government organizations; these requests were addressed within the first 15 days following conversations with the requester.

Of the 88 completed requests, 87 (98.9%) were completed within the prescribed time limits, including all extensions, which were taken in accordance with sub-paragraphs 15(a)(i) and 15(a)(ii) of the Privacy Act. Compared to the previous reporting period, this represents an increase of 10% in the on-time response rate.

For 4 requests (5%), the Secretariat sought extensions to the prescribed time limits in order to consult with other government organizations.

9. Exemptions Invoked

The Privacy Act allows, and in certain instances, requires that some personal information, such as information related to law enforcement investigations, information about other individuals or information that is subject to solicitor-client privilege, be exempted and not released.

In fiscal year 2019 to 2020, the Secretariat invoked a total of 15 exemptions as per specific sections of the Privacy Act, as follows:

• Section 26: Exempting personal information about individuals other than the requester (11)
• Section 27: Exempting personal information related to solicitor-client privilege (4)

10. Exclusions Invoked

The Privacy Act does not apply to information that is already publicly available, such as government publications and material in libraries and museums. It also excludes material such as Cabinet confidences. Consistent with the act, no exclusions were invoked in fiscal year 2019 to 2020.

11. Costs

During fiscal year 2019 to 2020, the ATIP office incurred $455,986 in salary costs and $45,151 in administrative costs (software licences, office equipment and supplies, training) to ensure appropriate implementation of the Privacy Act.

These costs do not include resources expended by the Secretariat’s sectors to meet the requirements of the act.

12. Impact to ATIP Operations as a Result of the COVID-19 Pandemic

In response to the exceptional mitigation measures implemented to minimize the effects of COVID-19, the Treasury Board of Canada Secretariat activated its business continuity plan on March 16, 2020, which prioritized limited network capacity to officials identified as performing critical services. Non-critical services, including ATIP, were provided with limited access to the departmental network which had an impact on the ability of the ATIP office to meet its obligations under the Privacy Act.

During the period of March 16, 2020 to March 31, 2020, the ATIP office closed eight Access to Information Act and Privacy Act requests, of which four (50%) exceeded legislated deadlines.

Exacerbating the operational impacts described above and resulting from limited access to the network, the ATIP office was required to simultaneously update its procedures to reflect a new digital environment in order to ensure continuity of operations. The ATIP office engaged with sector officials to advise and establish best practices in completing ATIP searches remotely. Concurrently, the ATIP office also modernized internal procedures to reflect the digital environment and ensure requests are processed efficiently and within legislated deadlines to the extent possible.

Furthermore, consistent with COVID-19 ATIP Implementation notice effective March 20, 2020, the ATIP office engaged with applicants to advise of potential processing delays and to propose options designed to facilitate the provision of records within legislated deadlines.

During the two-week period, the ATIP office provided privacy advice and guidance to TBS program officials in the development of two critical initiatives for reporting employee status information: the TBS Employee Status Reporting Application (by the TBS Human Resources Division) and the COVID-19 Tracking System (by the Office of the Chief Human Resources Officer). The two electronic reporting tools were developed in support of the federal government’s efforts to ensure the health and safety of public service employees. The Employee Status Reporting application is an internal tool used to collect departmental data to understand the impacts of COVID-19 on TBS’s workforce and business continuity plan. The COVID-19 Tracking system is a government-wide tool used to collect departments and agencies’ organizational data at the aggregate level to understand how COVID-19 is affecting employees and operational abilities across government. On behalf of TBS program officials, the ATIP office informed the Office of the Privacy Commissioner about these two COVID‑related initiatives.

13. Training and Awareness

During the 2019 to 2020 fiscal year, the ATIP office continued to expand on its outreach activities and provided several training sessions to departmental employees. Twenty-nine separate sessions were provided to 489 employees on Privacy, Access legislation and on C-58 implementation. Some of these sessions were adapted to the specific needs of divisional teams and sectors within the Secretariat. The ATIP office also engaged with its sector liaison officer network to coordinate larger sector-wide ATIP training sessions and collaborated with the Corporate Services Sector to include privacy training as part of the mandatory introductory training program for new employees. Furthermore, the ATIP office provided two separate training sessions to 50 TBS volunteers for the Government of Canada Workplace Charitable Campaign.

Again, this year, in support of Right to Know Week, the ATIP office held an open-door session to showcase its services, promote sound information management practices, and answer questions about the access to information process at TBS.

In addition, to mark Data Privacy Day, the ATIP office promoted the importance of sound privacy management practices and the shared responsibility of employees for safeguarding personal information in their day-to-day activities. The ATIP office co-lead the coordination of a privacy kiosk with colleagues in the Office of the Chief Information Officer, where employees were engaged in challenging their knowledge of privacy practices.

14. Policies, Guidelines, Procedures and Initiatives

During the 2019 to 2020 reporting period, the ATIP office implemented several initiatives both within its operational unit and with stakeholders in the institution. These initiatives were in keeping with a continued approach to streamlining its operational processes. Part of these initiatives included leveraging secure IT solutions to reduce transition times between various units in the processing of ATIP requests.

Over the course of the fiscal year, there has been a notable increase in internal requests from TBS program officials for privacy-related advice and guidance. The upward trend can be attributed to the number of new and forward-looking program initiatives involving the potential collection, use and disclosure of personal information, the growing interest in the use of cloud technologies, and the increase in government-wide employee engagement and public outreach activities. This year, the ATIP office continued to support TBS program officials in ensuring compliance with privacy legislation and policy requirements by developing new tools for TBS’s internal Privacy Management Framework.

In September 2017, the ATIP office approached the Secretariat’s Internal Audit and Evaluation Bureau to undertake a department-wide privacy audit and evaluation in order to assess the soundness and effectiveness of privacy practices at the Secretariat. The ATIP office developed a Management Response Action Plan and has since actioned many of the recommendations as per the audit. Over the course of the reporting period, internal capacity was expanded with the hiring of two new program analysts to support the increasing workload specific to privacy activities.

Finally, in order to ensure continued compliance with the acts and related policies, the ATIP office disseminated a variety of tools and checklists, and held face-to-face meetings with program officials to ensure compliance with relevant policy and legislative requirements.

15. Summary of Key Issues and Actions Taken on Complaints or Audits

Requesters are entitled to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) regarding the processing of their request.

Clients of the Secretariat filed one new complaint with the OPC in fiscal year 2019 to 2020 related to delay in responding.

The OPC discontinued one complaint during the reporting period with regards to delay in responding. This complaint was received in 2017.

The OPC had previously suspended their investigation into 10 departmental complaints pertaining to TBS’s Standard on Security Screening pending litigation before the Federal Court of Appeal (FCA). Following the FCA’s decision in July 2019 to dismiss the appeal, the OPC discontinued its investigation.

There remain two active Privacy Act complaints.

There were no new court cases in fiscal year 2019 to 2020.

There have been no court cases against the Secretariat in relation to the Access to Information Act and the Privacy Act since 2004.

16. Monitoring Compliance

The ATIP office distributes weekly compliance statistics that are shared with the program areas and senior management for all access to information requests.

TBS processed 1 request for correction of personal information over the reporting period.

17. Material Privacy Breaches

The Secretariat did not incur any material privacy breaches over the reporting period.

18. Privacy Impact Assessments

The ATIP office provides TBS program officials with support and guidance on the Privacy Impact Assessment (PIA) process. In accordance with the TBS Directive on Privacy Impact Assessment, a PIA must be initiated for a program or activity in the following circumstances:

• when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual
• upon substantial modifications to existing programs or activities where personal information is used or intended to be used for an administrative purpose
• when the contracting out or the transfer of a program or activity to another level of government or to the private sector results in substantial modifications to the program or activities

During the fiscal year 2019 to 2020, TBS submitted to the Office of the Privacy Commissioner of Canada (OPC) and to the Information Privacy Policy Division (IPPD) the PIA for the Claims Process for Phoenix pay system issues (Phase 2).

In addition, the ATIP office continued to support TBS program officials on a number of on-going privacy impact assessments, including the Talent Cloud (Phase 2) PIA, the ATIP online request portal (Phase 2) PIA, the Canada Financial and Material Management Solution PIA as well as the Online Regulatory Consultation Program PIA.

19. Public Interest Disclosures

Subsection 8(2) of the Privacy Act provides limited and specific circumstances under which institutions may disclose personal information without an individual’s consent. Paragraph 8(2)(m) allows for the disclosure of personal information when the public interest clearly outweighs any invasion of privacy or when the disclosure would benefit the individual involved.

In the 2019 to 2020 reporting period, there were no disclosures pursuant to paragraph 8(2)(m) of the Privacy Act.

20. Information About Programs and Information

TBS publishes an inventory of its information holdings, as well as relevant details about personal information under their control.

The primary purpose of this publication containing information about, and collected by, the Government of Canada, is to assist individuals in exercising their rights under the Access to Information Act and the Privacy Act. It also supports the federal government’s commitment to facilitate access to information regarding its activities. All these publications are available to the public on the Internet, free of charge.

A description of the Secretariat’s functions, programs, activities and related information holdings can be found in Treasury Board Secretariat - Sources of Federal Government and Employee Information (Info Source).

As part of the annual update of the TBS Sources of Federal Government and Employee Information (formerly called Info Source), the ATIP office updated its publication on TBS information holdings based on feedback provided by program sectors during their last annual review. In the coming year, the ATIP office will be working with programs throughout the Secretariat to update the publication to reflect the current Departmental Results Framework structure.

Appendix A: Statistical Report on the Privacy Act

• In this section

  • Section 1: Requests under the Privacy Act
  • Section 2: Requests closed during the reporting period
  • Section 3: Disclosures under subsections 8(2) and 8(5)
  • Section 4: Requests for correction of personal information and notations
  • Section 5: Extensions
  • Section 6: Consultations received from other institutions and organizations
  • Section 7: Completion time of consultations on Cabinet confidences
  • Section 8: Complaints and investigations notices received
  • Section 9: Privacy Impact Assessments (PIAs)
  • Section 10: Material Privacy Breaches
  • Section 11: Resources related to the Privacy Act

Name of institution: Treasury Board of Canada Secretariat

Reporting period: 2019-04-01 to 2020-03-31

2019–2020 Supplemental Statistical Report – Requests affected by COVID-19 measures

In addition to completing the forms for the statistical reports on the Access to Information Act and the Privacy Act for 2019 to 2020, institutions are asked to complete this supplemental report to help identify the impact of COVID-19 measures on institutional performance for 2019 to 2020 and going forward. The data requirements are set out in the tables below.

Appendix B: Delegation Order

I, undersigned, President of the Treasury Board, pursuant to section 73 of the Privacy Act hereby designate the ATIP Advisors, the Access to Information and Privacy Team Leader, the Access to Information and Privacy Manager, the Access to Information and Privacy Director, the Senior Director of Ministerial Services, the Assistant Secretary, Strategic Communications and Ministerial Affairs and the Secretary, or persons occupying those positions on an acting basis, to exercise signing authorities or perform any of the President’s powers, duties or functions as head of institution that are specified in the attached Schedule B. This designation replaces all previous delegation orders.

Original signed by

The Honourable Jean-Yves Duclos
President of the Treasury Board
Date: 2019-12-13

© Her Majesty the Queen in Right of Canada, represented by the President of the Treasury Board, 2020,
[ISSN: 2371-3038]